CVE-2026-106428 MongoDB CVE debrief

Who should care

Defenders responsible for MongoDB C Driver deployments, particularly those using versions 1.1.0 to 1.30.12 or 2.0.0 to 2.3.99, should assess exposure and prioritize verification and remediation efforts.

Why it matters

Defenders should care about CVE-2026-106428 because it affects the MongoDB C Driver, potentially causing application termination when processing malformed server-final messages. This vulnerability requires verification of driver versions, assessment of exposure, and prioritization of remediation efforts to prevent potential disruptions.

• Termination of the application using the MongoDB C Driver due to processing a malformed server-final message.
• Potential disruption to services relying on the affected MongoDB C Driver deployments.
• Need for verification of MongoDB C Driver versions and exposure to untrusted server or network intermediary messages.
• Prioritization of remediation efforts for affected deployments.

Technical summary

The MongoDB C Driver is vulnerable to an out-of-bounds read issue in SCRAM authentication response parsing. This occurs when processing a malformed server-final message, which can cause the application using the driver to terminate. The vulnerability is classified as MEDIUM severity with a CVSS score of 6.3. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol. Defenders should prioritize verifying the versions of MongoDB C Driver in use and assessing exposure to untrusted server or network intermediary messages.

Defensive priority

Defenders should prioritize verifying the versions of MongoDB C Driver in use and assessing exposure to untrusted server or network intermediary messages.

Recommended defensive actions

• Verify the version of MongoDB C Driver in use and ensure it is within the supported and fixed versions.
• Assess exposure to untrusted server or network intermediary messages that could be used to exploit this vulnerability.
• Implement compensating controls, such as validating server-final messages, to prevent exploitation.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions of the MongoDB C Driver. The vulnerability is caused by an out-of-bounds read in SCRAM authentication response parsing. The extra byte is not returned through the protocol. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. Defenders should verify the versions of MongoDB C Driver in use and assess

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.